虛擬機 - 惡意程式攻防的新戰場. 講師簡介王大寶, 小時候大家叫他王小寶, 長大後就稱王大寶, 目前隸屬一神祕單位. 雖然佯稱興趣在看書與聽音樂, 但是其實晚上都在打 Game. 長期於系統最底層打滾, 熟悉 ASM,C/C++,

Transcription

1 王大寶, PK

2 虛擬機 - 惡意程式攻防的新戰場 講師簡介王大寶, 小時候大家叫他王小寶, 長大後就稱王大寶, 目前隸屬一神祕單位. 雖然佯稱興趣在看書與聽音樂, 但是其實晚上都在打 Game. 長期於系統最底層打滾, 熟悉 ASM,C/C++, 對於資安毫無任何興趣, 也無經驗, 純粹是被某壞人騙上台, 可以說是不可多得的素人講師!! 議程大綱 : 現今的 CPU 都支援虛擬化專用指令集, 讓 VM 獲得硬體的支援. 在這個場次中, 我們將詳細地介紹 Intel 的 VT 指令集與其 Hypervisor 運作的機制. 此外我們將並介紹在惡意軟體研究領域中在 Hypervisor 模式下能有哪些應用, 包含惡意程式技術與偵防分析的應用. 最後我們將介紹自行開發能在 Hypervisor 模式下運作的 Malware POC, 而且是無法被目前防毒與防護系統偵測到!

3 Agenda VMM on x86 Hardware assisted architecture VMM software implementing Security & VMM

4 What is VMM Has full control over the platform A thin layer between the physical hardware and virtualized environment Be able to retain selective control from guest software The real world

5

6 現實是殘酷的, 從 VM 中醒過來不一定是好事 :P

7 What is VMM (conti.) Guest OS 1 Guest OS 2 VMM Physical Processor

8 Types of Hypervisors

9 Intel VT-x Introduced by Intel Includes a new set of instructions Totally isolated environments for each guest Solved many problems which were caused by guest OS executing at the same level of host OS Provides better performance than byte code emulation

10 Keywords VMM runs at VMX root operation Guest software runs at VMX non-root operation Transition from VMM to guest software is called VM entry Transition from guest software to VMM is called VM exit

11 VMX root operation Check CPU capabilities mov eax, 1 cpuid test ecx, 20h 5 VMX Virtual Machine Extensions

12 VMX root operation (conti.) Prepare a non-pageable memory (VMXON Region) storage of host context aligned to 4KB in MTRR range Write Back (type 6) size = MSR#480 [43:32] rev_id = MSR#480 [31:0] rev_id VMXON Region Size

13 VMX root operation (conti.) Enable VMXE bit (bit13) in CR4 mov eax, cr4 or eax, Bit13 mov cr4, eax 13 VMXE Virtual Machine Extensions Enabled

14 VMX root operation (conti.) VMXON instruction vmxon phymem_vmxon_region Hello, real world

15 VMX non-root operation Prepare a non-pageable memory (VMCS) storage of guest software states aligned to 4KB in MTRR range Write Back (type 6) size = MSR#480 [43:32] rev_id = MSR#480 [31:0]

16 VMX non-root operation (conti.) Instructions to initialize VMCS VMCLEAR, VMPTRLD VMCLEAR Initialize the new VMCS region in memory Set the launch state to clear Invalidates the working VMCS pointer register VMPTRLD Initializes the working VMCS pointer with the new VMCS region's physical address. Validates the working VMCS pointer register

17 VMX non-root operation (conti.) Instructions to access specific field of VMCS VMWRITE, VMREAD Each field has its encoding Example: GUEST_RIP = 681eh To set GUEST_RIP into VMCS: mov vmwrite eax, 681eh eax, dword ptr NEW_GUEST_RIP To get GUEST_RIP from VMCS: mov vmread eax, 681eh ebx, eax

18 VMX non-root operation (conti.) Now it is time to run guest software VMLAUNCH, VMRESUME Launch state of VMCS will be set to launched

19 VMM, VMCS, Guest OS Guest OS 1 Guest OS 2 VMXON Region #A VMXON Region #B VMCS #1A VMCS #2A VMCS #2B VMCS #1B CPU#A CPU#B

20 VM exit handling VMM gets VM exit reason from VMCS, determines handle it or not Bit Position(s) Contents 15:0 Basic exit reason 27:16 Reserved (cleared to 0) 28 Pending MTF VM exit 29 VM exit from VMX root operation 30 Reserved (cleared to 0) 31 VM-entry failure (0 = true VM exit; 1 = VM-entry failure)

21 VM exit handling (conti.) VM exit basic reasons > 50 Sensitive instructions Privilege registers change Exceptions Exit qualification contains additional information Execute VMRESUME after handled VM exit

22 Lifecycle of a VMM software VMM Lives VM Entry VMXON VMM Guest VMXOFF VM Exit

23 VT-x Operations VM 1 VM 2 VM n VMX Non-root Operation Ring 3 Ring 0 Ring 3 Ring 0... Ring 3 Ring 0 VM Exit VMCS 1 VMCS 2 VMCS n IA-32 VMX Root Operation VMXON VMLAUNCH VMRESUME Ring 3 Ring 0 System VMs

24 Security & VMM VMM is transparent to its guests A well-implemented VMM is very hard to be detected Almost all VMM-detection technologies in present are based on flaws of VMM itself A positive usage of VMM could be a very powerful weapon against various attacks of malwares So could be in either way But

25 Security & VMM (conti.) Difficulties in implementing VMM No OS API No existed input/output No existed drivers Developers implement everything in VMM Disk read/write Keyboard input/output Control video RAM for output Direct manipulation on NIC, USB stack

26 VMX vs. SMM In a software developer s aspect, VMX operation is very similar to SMM Transparent to client Has processor context storage Full control over system Isolated environment, DIY everything Differences SMM is triggered by hardware SMM has higher priority than VMX SMM is not accessible at runtime

27 Malware and VMM How to detect or analysis Kernel Malware?? User mode Malware Kernel Behavior Monitor Kernel mode Malware???

28 Demo 1: Invisible VMM Keylogger A handcrafted key logger in VMM Capture KB input from I/O port Hidden File in Guest OS File system! Definitely invisible Ya Cant be detected by any Anti-Virus or HIPS in the world

29 VMM Keylogger File System Implemented in VMM hitkey2010 has been saved to disk

30 Demo2: Rootkit Detection Physical Memory Forensics with VMM!! EPROCESS parsing SSDT parsing Etc. Demo our new toy

31 VMM on Forensic Approach Found a process that hidden by Fu rootkit

32 Q&A

33 Reference Intel 64 and IA-32 Architectures Software Developer's Manual Vol.2, Vol